Published vulnerability records have more than tripled in a year, from about 4,000 a month to nearly 15,000. The CVE record shows AI's fingerprints, but it still cannot say who, or what, found most of them.
China now has some of the fastest incident-reporting deadlines in the world, tougher Cybersecurity Law fines and new yearly risk assessments for important data. Large platforms may face data localisation next.
The EU is easing parts of its digital rulebook while switching on new cyber duties. Product makers now report exploited flaws within 24 hours, and the AI Office can fine.
The first annual DORA incident report came out in June, while much of Europe was on holiday. It holds lessons on cyber attacks and harder ones on disaster recovery.
Since 1 October 2026 Japan's core infrastructure must report cyber attacks to the state within days. Privacy fines follow by 2028, but Tokyo still prefers guidance to penalties.
Five years on, the federal privacy law still has no implementing rules. A new AI and Data Authority may change that, while the central bank and the free zones already enforce.
The Cyber Security and Resilience Bill reaches Lords report stage on 26 October, bringing 24-hour incident reporting. Meanwhile the ICO has a new board and financial firms face new reporting rules from March 2027.
Washington is trimming cyber rules and dropping test cases, while New York, California and state attorneys general step up. The long-delayed critical infrastructure incident reporting rule is the big federal item to watch.
New articles on cyber, privacy and AI law, the Cyber Risk Barometer twice a year, and a monthly round-up of national CERT warnings.